Malicious code in 3layerdipstackelcuhp (npm)

The npm package '3layerdipstackelcuhp' version 0.1.4 was identified by Amazon Inspector and GHSA malware sources as containing malicious code or relying on a malicious dependency. This results in a full system compromise upon installation or execution. The advisory warns that all secrets and keys on the compromised system should be rotated from a separate device, and that removal of the package does not guarantee eradication of all malicious software installed as a consequence.

Systems with '3layerdipstackelcuhp' version 0.1.4 installed or running should be considered fully compromised. Attackers may have gained full control, risking exposure of all stored secrets and keys. The compromise may persist beyond removal of the package, indicating potential for ongoing unauthorized access or data exfiltration.

Remove the '3layerdipstackelcuhp' package version 0.1.4 immediately. Rotate all secrets and keys stored on the affected system from a separate, trusted computer. Because full compromise is likely, consider rebuilding or thoroughly cleaning the affected system to ensure removal of all malicious components.